Most probably 2.3.0 isn't compatible but they released the new 3.0 version three days ago. You should test that.  

Yes you can do it with gpo. Here's the guide from duo with the resources needed to do it.https://duo.com/docs/winlogon-gpo

I don't know if this article is outdated but there it says rdweb-2.3.0 is supported until windows 2019 and DUO 2FA is not supported for web client for RDS 2016/2019https://help.duo.com/s/article/1109?language=en_USI hope it helps